CVE-2025-9816 Analysis & POC

<?php
use WP_STATISTICS\Helper;
?>

<div class="postbox-container wps-postbox-full">
  <?php if (!empty($data['visitors'])) : ?>
      <div class="o-table-wrapper">
          <table width="100%" class="o-table wps-new-table">
              <thead>
              </thead>
              <tbody>
                  <?php foreach ($data['visitors'] as $item) : ?>
                      <tr>
                          <td class="wps-pd-l">
                              <span title="<?php echo \WP_STATISTICS\Admin_Template::unknownToNotSet($item->model); ?>" class="wps-model-name">
                                  <?php echo self::isUnknown($item->model) ? esc_html__('Unknown', 'wp-statistics') : $item->model; ?>
                              </span>
                          </td>
                      </tr>
                  <?php endforeach; ?>
              </tbody>
          </table>
      </div>
  <?php else : ?>
      <div class="o-wrap o-wrap--no-data wps-center">
          <?php esc_html_e('No recent data available.', 'wp-statistics'); ?>
      </div>
  <?php endif; ?>
</div>

public static function isUnknown($value)
{
    if (empty($value) or $value == 'Unknown' or $value == __("Unknown", 'wp-statistics')) {
        return true;
    }

    return false;
}

public static function unknownToNotSet($value)
{
    if (self::isUnknown($value)) {
        return __('(not set)', 'wp-statistics');
    }
    return $value;
}

class TabsView extends BaseTabView
{
    public function render()
    {
        $currentTab  = $this->getCurrentTab();
        $data        = $this->getTabData();

        $args = [
            'title'           => esc_html__('Devices', 'wp-statistics'),
            'pageName'        => Menus::get_page_slug('devices'),
            'paged'           => Admin_Template::getCurrentPaged(),
            'custom_get'      => ['tab' => $currentTab],
            'data'            => $data,
            'viewMoreUrlArgs' => ['type' => 'single-' . rtrim($currentTab, 's'), 'from' => Request::get('from'), 'to' => Request::get('to')],
            'tabs'            => [
                [
                    'link'        => Menus::admin_url('devices', ['tab' => 'overview']),
                    'title'       => esc_html__('Overview', 'wp-statistics'),
                ],
                [
                    'link'        => Menus::admin_url('devices', ['tab' => 'browsers']),
                    'title'       => esc_html__('Browsers', 'wp-statistics'),
                ],
                [
                    'link'        => Menus::admin_url('devices', ['tab' => 'platforms']),
                    'title'       => esc_html__('Operating Systems', 'wp-statistics'),
                ],
                [
                    'link'        => Menus::admin_url('devices', ['tab' => 'models']),
                    'title'       => esc_html__('Device Models', 'wp-statistics'),
                ],
                [
                    'link'        => Menus::admin_url('devices', ['tab' => 'categories']),
                    'title'       => esc_html__('Device Categories', 'wp-statistics'),
                ]
            ],
        ];

        Admin_Template::get_template(['layout/header', 'layout/tabbed-page-header', "pages/devices/$currentTab", 'layout/postbox.hide', 'layout/footer'], $args);
    }
}

// $param='tab'
public static function get($param, $default = false, $return = 'string')
{
    if (empty($_REQUEST[$param])) return $default;

    $value = $_REQUEST[$param];

    if ($return === 'string') {
        return sanitize_text_field($value);
    }

    if ($return === 'url') {
        return sanitize_url($value);
    }

    if ($return === 'number') {
        return intval($value);
    }

    if ($return === 'text') {
        return sanitize_textarea_field($value);
    }

    if ($return === 'bool') {
        return boolval($value);
    }

    if ($return === 'array' && is_array($value)) {
        return array_map('sanitize_text_field', $value);
    }

    return $value;
}

// $data = $this->getTabData();
protected function getTabData()
{
    $currentTab     = ucwords($this->getCurrentTab(), '-');
    $tabDataMethod  = 'get' . str_replace('-', '', $currentTab) . 'Data'; // getModelsData

    if (!method_exists($this, $tabDataMethod)) {
        // Filter to add data for locked tab
        return apply_filters("wp_statistics_{$this->getCurrentPage()}_{$this->getCurrentTab()}_data", []);
    };

    return $this->$tabDataMethod();
}

public function __construct()
{
    parent::__construct();

    $this->dataProvider = new DevicesDataProvider([
        'per_page' => 10,
        'page'     => Admin_Template::getCurrentPaged()
    ]);
}

public function getModelsData()
{
    return $this->dataProvider->getModelsData();
}

public function __construct($args)
{
    $this->args = $args;

    $this->visitorsModel = new VisitorsModel();
}

public function getModelsData()
{
    $args = array_merge($this->args, [
        'field'    => 'model',
        'group_by' => ['model']
    ]);

    $visitors = $this->visitorsModel->getVisitorsDevices($args);

    if (! empty($visitors)) {
        $visitors = array_reduce($visitors, function ($carry, $item) {
            // Trim whitespace and default empty models to 'Unknown'
            $model = trim($item->model ?? '');

            if ($model === '') {
                $model = 'Unknown';
            }

            if (isset($carry[$model])) {
                $carry[$model]->visitors += $item->visitors;
            } else {
                $carry[$model] = (object)[
                    'model'    => $model,
                    'visitors' => $item->visitors
                ];
            }
            return $carry;
        }, []);
    }

    return [
        'visitors' => $visitors,
        'total'    => $this->visitorsModel->countColumnDistinct($args),
        'visits'   => $this->visitorsModel->countColumnDistinct(array_merge($args, ['field' => 'ID'])),
    ];
}

public function getVisitorsDevices($args = [])
{
    $args = $this->parseArgs($args, [
        'field'          => 'agent',
        'date'           => '',
        'where_not_null' => '',
        'group_by'       => [],
        'order_by'       => 'visitors',
        'order'          => 'DESC',
        'per_page'       => '',
        'page'           => 1,
    ]);

    $result = Query::select([
        $args['field'],
        'COUNT(visitor.ID) AS `visitors`',
    ])
        ->from('visitor')
        ->whereDate('last_counter', $args['date'])
        ->whereNotNull($args['where_not_null'])
        ->groupBy($args['group_by'])
        ->orderBy($args['order_by'], $args['order'])
        ->perPage($args['page'], $args['per_page'])
        ->getAll();

    return $result ? $result : [];
}

mysql> desc wp_statistics_visitor;
+----------------+-----------------+------+-----+---------+----------------+
| Field          | Type            | Null | Key | Default | Extra          |
+----------------+-----------------+------+-----+---------+----------------+
| ID             | bigint          | NO   | PRI | NULL    | auto_increment |
| last_counter   | date            | NO   | MUL | NULL    |                |
| referred       | text            | NO   |     | NULL    |                |
| agent          | varchar(180)    | NO   | MUL | NULL    |                |
| platform       | varchar(180)    | YES  | MUL | NULL    |                |
| version        | varchar(180)    | YES  | MUL | NULL    |                |
| device         | varchar(180)    | YES  | MUL | NULL    |                |
| model          | varchar(180)    | YES  | MUL | NULL    |                |
| UAString       | varchar(190)    | YES  |     | NULL    |                |
| ip             | varchar(60)     | NO   | MUL | NULL    |                |
| location       | varchar(10)     | YES  | MUL | NULL    |                |
| user_id        | bigint          | NO   |     | NULL    |                |
| hits           | int             | YES  |     | NULL    |                |
| honeypot       | int             | YES  |     | NULL    |                |
| city           | varchar(100)    | YES  |     | NULL    |                |
| region         | varchar(100)    | YES  |     | NULL    |                |
| continent      | varchar(50)     | YES  |     | NULL    |                |
| source_channel | varchar(50)     | YES  |     | NULL    |                |
| source_name    | varchar(100)    | YES  |     | NULL    |                |
| first_page     | bigint unsigned | YES  |     | NULL    |                |
| first_view     | datetime        | YES  |     | NULL    |                |
| last_page      | bigint unsigned | YES  |     | NULL    |                |
| last_view      | datetime        | YES  |     | NULL    |                |
+----------------+-----------------+------+-----+---------+----------------+

protected function checkSignature($request)
{
    if (Helper::isRequestSignatureEnabled()) {
        $signature = $request->get_param('signature');
        $payload   = [
            $request->get_param('source_type'),
            (int)$request->get_param('source_id'),
        ];

        if (!Signature::check($payload, $signature)) {
            return new \WP_Error('rest_forbidden', __('Invalid signature', 'wp-statistics'), array('status' => 403));
        }
    }

    return true;
}

public function hit_callback()
{
    $statusCode = false;

    try {
        Helper::validateHitRequest();
        Hits::record();

        $responseData['status'] = true;

    } catch (Exception $e) {
        $responseData['status'] = false;
        $responseData['data']   = $e->getMessage();
        $statusCode             = $e->getCode();
    }

    $response = rest_ensure_response($responseData);

    if ($statusCode) {
        $response->set_status($statusCode);
    }

    $response->set_headers(array(
        'Cache-Control' => 'no-cache',
    ));

    return $response;
}

// Helper::validateHitRequest();
public static function validateHitRequest()
{
    $isValid = Request::validate([
        'page_uri'     => [
            'required'        => true,
            'nullable'        => true,
            'type'            => 'string',
            'encoding'        => 'base64',
            'invalid_pattern' => self::injectionPatterns()
        ],
        'search_query' => [
            'required'        => true,
            'nullable'        => true,
            'type'            => 'string',
            'encoding'        => 'base64',
            'invalid_pattern' => self::injectionPatterns()
        ],
        'source_id'    => [
            'type'     => 'number',
            'required' => true,
            'nullable' => false
        ],
        'referred'     => [
            'required' => true,
            'nullable' => true,
            'type'     => 'url',
            'encoding' => 'base64'
        ],
    ]);

    if (!$isValid) {
        do_action('wp_statistics_invalid_hit_request', $isValid, IP::getIP());
        throw new ErrorException(esc_html__('Invalid hit/online request.', 'wp-statistics'));
    }

    return true;
}

// Hits::record();
public static function record($visitorProfile = null)
{
    if (!$visitorProfile) {
        $visitorProfile = new VisitorProfile();
    }

    /**
        * Record Pages
        */
    $pageId = false;
    if (Pages::active()) {
        $pageId = Pages::record($visitorProfile);
    }

    /**
        * Record Visitor Detail
        */
    $visitorId = false;
    if (Visitor::active()) {
        $visitorId = Visitor::record($visitorProfile, ['page_id' => $pageId]);
    }

    // other logic
}

 public static function record($visitorProfile, $arg = array())
{
    global $wpdb;

    // Define the array of defaults
    $defaults = array(
        'location'         => '',
        'exclusion_match'  => false,
        'exclusion_reason' => '',
        'page_id'          => 0
    );

    $userAgent    = $visitorProfile->getUserAgent(); <-- focus
    $same_visitor = $visitorProfile->isIpActiveToday();

    // If we have a new Visitor in Day
    if (!$same_visitor) {

        // Prepare Visitor information
        $visitor = array(
            'agent'          => $userAgent->getBrowser(),
            'platform'       => $userAgent->getPlatform(),
            'version'        => $userAgent->getVersion(),
            'device'         => $userAgent->getDevice(),
            'model'          => $userAgent->getModel(), <-- focus
            // other logic
        );

        $visitor = apply_filters('wp_statistics_visitor_information', $visitor);

        //Save Visitor TO DB
        $visitor_id = self::save_visitor($visitor, $visitorProfile);

    } else {
    }
}

public function getModel()
{
    $model = '';

    if (! empty($this->deviceDetector)) {
        $brand  = $this->deviceDetector->getBrandName();
        $device = $this->deviceDetector->getModel();

        if (!empty($device)) {
            $words = explode(' ', trim($device));
            $device = $words[0] ?? null;

            if (! empty($device) && ctype_digit($device)) {
                $device = '';
            }
        }

        $model = trim($brand . ' ' . $device);
    }      

    return $model ?? null;
}

class UserAgentService
{
    public function __construct()
    {
        try {
            // Get HTTP User Agent
            $userAgent = UserAgent::getHttpUserAgent();

            // Initialize DeviceDetector with the user agent string
            $this->deviceDetector = new \WP_Statistics\Dependencies\DeviceDetector\DeviceDetector($userAgent);
            $this->deviceDetector->parse();

        } catch (Exception $e) {
            // In case of an error, set deviceDetector to null
            $this->deviceDetector = null;
        }
    }
}

class DeviceDetector 
{
    public function __construct(string $userAgent = '', ?ClientHints $clientHints = null)
    {
        if ('' !== $userAgent) {
            $this->setUserAgent($userAgent);
        }

        if ($clientHints instanceof ClientHints) {
            $this->setClientHints($clientHints);
        }

        $this->addClientParser(new FeedReader());
        $this->addClientParser(new MobileApp());
        $this->addClientParser(new MediaPlayer());
        $this->addClientParser(new PIM());
        $this->addClientParser(new Browser());
        $this->addClientParser(new Library());

        $this->addDeviceParser(new HbbTv());
        $this->addDeviceParser(new ShellTv());
        $this->addDeviceParser(new Notebook());
        $this->addDeviceParser(new Console());
        $this->addDeviceParser(new CarBrowser());
        $this->addDeviceParser(new Camera());
        $this->addDeviceParser(new PortableMediaPlayer());
        $this->addDeviceParser(new Mobile());

        $this->addBotParser(new Bot());
    }
}

class Mobile extends AbstractDeviceParser
{
    /**
     * @var string
     */
    protected $fixtureFile = 'regexes/device/mobiles.yml';

    /**
     * @var string
     */
    protected $parserName = 'mobile';
}

# Gol Mobile (gol-mobile.com)
Gol Mobile:
  regex: '(?:F10_PRIME|F3Prime|F9_PLUS|TEAM_7_3G)(?:[);/ ]|$)'
  device: 'smartphone'
  models:
    - regex: 'F10_PRIME'
      model: 'F10 Prime'
    - regex: 'F3Prime'
      model: 'F3 Prime'
    - regex: 'F9_PLUS'
      model: 'F9 Plus'
    - regex: 'TEAM_7_3G'
      device: 'tablet'
      model: 'Team 7.0 3G'

# Goly: 
Goly:
  regex: 'Goly[ _-]'      # match when UA contains "Goly-" or "Goly_" or "Goly "
  device: 'smartphone'    # device type
  models:
    - regex: 'Goly[ _-]([^;/]+) Build'   # capture model before "Build"
      model: '$1'
    - regex: 'Goly[ _-]([^;/)]+)(?:[;/)]|$)'  # capture model before ; / ) or end-of-string
      model: '$1'

# other model

public function parse(): void
{
    if ($this->isParsed()) {
        return;
    }

    $this->parsed = true;

    // skip parsing for empty useragents or those not containing any letter (if no client hints were provided)
    if ((empty($this->userAgent) || !\preg_match('/([a-z])/i', $this->userAgent))
        && empty($this->clientHints)
    ) {
        return;
    }
    // other parse

    $this->parseDevice();
}

protected function parseDevice(): void
{
    $parsers = $this->getDeviceParsers();

    foreach ($parsers as $parser) {
        $parser->setYamlParser($this->getYamlParser());
        $parser->setCache($this->getCache());
        $parser->setUserAgent($this->getUserAgent());
        $parser->setClientHints($this->getClientHints());

        if ($parser->parse()) {
            $this->device = $parser->getDeviceType();
            $this->model  = $parser->getModel();
            $this->brand  = $parser->getBrand();

            break;
        }
    }
    // other logic
}